Unauthorized usage of remote hardware module because of missing channel verification

Description

Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic firmware is an open source firmware implementation for the broader project. The remote hardware module of the firmware does not have proper checks to ensure a remote hardware control message was received should be considered valid. This issue has been addressed in release version 2.5.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Scores

EPSS (exploitation in 30 days)

0.19% · top 91% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.4.

Weakness

• CWE-345: Insufficient Verification of Data Authenticity (opens in a new tab)All about CWE-345 and its CVEs

Affected products

• meshtastic · firmware

  • affected < 2.5.1

References (1)

• https://github.com/meshtastic/firmware/security/advisories/GHSA-h8mh-p4r3-4jv7 (opens in a new tab)x_refsource_CONFIRM

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2024-47079](https://trackcve.app/badge/CVE-2024-47079.svg)](https://trackcve.app/cve/CVE-2024-47079)

Record last updated 7 Oct 2024, 20:19 UTC.